PT-2026-4371 · WordPress · Kama Thumbnail

Published 2026-01-23 · Updated 2026-01-25 · CVE-2026-24521

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kama Thumbnail versions through 3.5.1

Description A Cross-Site Request Forgery (CSRF) issue exists in Kama Thumbnail. This allows an attacker to potentially perform actions on behalf of an authenticated user without their knowledge.

Recommendations Update Kama Thumbnail to a version newer than 3.5.1.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2026-24521

Affected Products

Kama Thumbnail

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-24521 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/kama-thumbnail/vulnerability/wordpress-kama-thumbnail-plugin-3-5-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2015362479820513365 · Twitter Post